Signature based scanning has been the mainstay of the anti-virus industry for more than a decade, but its time is up, according to a number of suppliers.
The old method was simple. Step 1: Identify a computer virus specimen. Step 2: Create a "signature" to detect and eradicate the virus, and push the signature file out to a computer. Step 3: Repeat steps 1 and 2 again and again for new viruses and their variants.
But the rapidly multiplying malware epidemic means this approach is "static, old school," according to Jerry Egan, director of product management at Symantec ’s security technology and response division. With 12,000 new malware specimens each day to detect and eradicate, "we think that technique is reaching the end of its useful life," Egan says.
Another complication is that malware is now so artfully designed, "it spreads to 20 or 30 machines before it mutates," Egan points out. That means "your neighbor has one variant and you have another. The effectiveness of each signature has gone down."
While Symantec isn't quite ready to jettison signature-based detection, the coming year is going to see a shift toward other anti-malware techniques, including behaviour-based protection, heuristics such as examining good and bad file characteristics, reputational analysis, and even whitelisting and blacklisting to allow or disallow code to run, says Egan.
"The shift will be to a hybrid model that employs these," Egan says about Symantec's product development going forward.
"Our experience is that there has been a 700% increase this year over last year alone in malware," says Peter Beardmore, senior product marketing manager at Kaspersky Lab. "This is absolutely challenging the traditional approach to signatures."
Kaspersky sees its detection model shifting, too. "Rather than the pattern of code, there's a pattern of calls made in that code," says Beardmore. "It might be calling the printer or registry," so the malware would be identified through more behavior-based methods.
Kaspersky will also be adding to all its desktop products the whitelisting and blacklisting approach it tried in its consumer products last summer through a partnership with Bit9. These technologies seem more adapted to the desktop right now, so Kaspersky hasn't pinpointed a strategy for this use in servers yet.
Trend Micro's vice president of core technology solutions, John Maddison, agrees the malware epidemic is challenging traditional signature-based detection where signature files are downloaded and stored on the computer itself.
"By 2015, we predict upwards of 25,000 new signatures per hour just to keep up," says Maddison.
Trend Micro's approach, outlined by CEO Eva Chen in early 2008, is to put the signature patterns "in the cloud," with Trend Micro's SmartProtection detection.
This approach, now in beta with 30 customers and expected to be rolled out in the second quarter of 2009, involves computers protected with Trend Micro's agent-based software that can query the cloud to detect and eradicate known malware.
For the enterprise, Trend Micro will simply "put a replication of the cloud on a server" and "the cloud will come to them," Maddison says. "The cloud has to become real-time with sophisticated updating methods to be updated almost instantly." Web-threat protection is another arrow in the quiver to detect malware, Maddison says.
Dave Marcus, director of security research and communications at McAfee, agrees signature-based detection "is less important than it was five years ago, when you consider the sheer volume of malware out there."
McAfee has already begun a shift to cloud-based malware detection, and sees behavior-based detection as a good augmentation as well. But Marcus adds: "Signature-based recognition will always be part of security technologies going forward."